Wire health probes, host stats, and LLM proxy round-trip

Three things from the latest arcadia-app pull:

- health.ts: client for /api/v1/health{,/:service,/detailed,/host}.
  monitoring.tsx now reads real per-subsystem probe state instead of
  synthesizing it from indirect signals (rate limits, sessions, jobs).
- New Host tab on Monitoring with KPI tiles + per-core CPU bars,
  load-avg cards, memory + swap usage, and per-mount disk bars,
  backed by /api/v1/health/host.
- llm-proxy.ts: typed errors (secret_disabled, ip_not_allowed, etc.)
  and a probeProxy() that round-trips a 1-token chat. settings.tsx's
  "Test connection" in proxy mode now exercises the real endpoint
  instead of just confirming the adapter built. Contract doc flipped
  from "not yet implemented" to "implemented".

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

app/routes/settings.tsx

@@ -18,6 +18,7 @@ import {
 } from "@crema/llm-providers-ui"
 import { useArcadiaClient } from "@crema/arcadia-client"
 
+import { probeProxy, type LLMProxyProvider } from "~/lib/arcadia/llm-proxy"
 import { AppShell } from "~/components/layout/app-shell"
 import { Button } from "~/components/ui/button"
 import {
@@ -98,15 +99,15 @@ export default function SettingsRoute() {
         arcadiaTenantId,
       })
 
-      // In proxy mode the adapter just being built is the strongest signal we
-      // can get without actually firing a chat request — the proxy endpoint
-      // doesn't exist on the backend yet, so any /models probe would 404.
+      // Proxy mode: round-trip a 1-token chat to verify auth → secret
+      // resolution → upstream dispatch end-to-end. Maps the contract's
+      // specific error codes to user-facing messages.
       if (s.mode === "proxy") {
-        return {
-          ok: true,
-          message:
-            "Adapter built. Note: the backend proxy (/api/v1/ai/llm/chat) isn't deployed yet — see docs/LLM_PROXY_CONTRACT.md.",
-        }
+        return probeProxy(arcadia, {
+          provider: s.providerId as LLMProxyProvider,
+          model: s.model || (s.providerId === "anthropic" ? "claude-opus-4-7" : "gpt-4o-mini"),
+          secretName: s.secretName || undefined,
+        })
       }
 
       // Direct mode — for OpenAI-compatible endpoints, /models is a cheap probe.